CVE-2020-1472 PoC — Microsoft Windows Netlogon 安全特征问题漏洞

Description

CVE-2020-1472 - Zero Logon vulnerability Python implementation

介绍

![Python][python-shield]

# CVE-2020-1472

CVE-2020-1472 - Zero Logon vulnerability Python implementation

## Description

* A Python script which uses the Impacket library to test for CVE-2020-1472 - Zerologon vulnerability (credits to Secura research).
* The flaw stems from the Netlogon Remote Protocol, available on Windows domain controllers, which is used for various tasks related to user and machine authentication.
* Specifically, the issue exists in the usage of AES-CFB8 encryption for Netlogon sessions. The AES-CFB8 standard requires that each “byte” of plaintext have a randomized initialization vector (IV), blocking attackers from guessing passwords. However, Netlogon’s ComputeNetlogonCredential function sets the IV to a fixed 16 bits – not randomized –  meaning an attacker could control the deciphered text.
* "Due to incorrect use of an AES mode of operation it is possible to spoof the identity of any computer account (including that of the [Domain Controller] itself) and set an empty password for that account in the domain,” according to Secura researchers.

![Description](https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/15102209/microsoft-window-attack.png)

* The script attempts to perform Netlogon authentication bypass. The script will terminate when succesfully 
performing the bypass.
* When a domain controller is patched, the script will stop after sending 2000 pairs of RPC calls (target is not vulnerable with a false negative chance of 0.04%).
* Note that by default this changes the password of the domain controller account. This allows to DCSync, but it also breaks communication with other DCs.
* More info and original research [here](https://www.secura.com/blog/zero-logon)

## Prerequisites

```
pip install impacket
```
or Download the impacket release [here](https://github.com/SecureAuthCorp/impacket/releases). Unpack it, and in the directory where you placed it, run:
```
pip install .
```

## Usage

Given a domain controller named `DC-NAME` with IP address `X.X.X.X`, run the script as follows:

    python cve-2020-1472.py DC-NAME X.X.X.X

The DC name is the NetBIOS computer name. If this name is not correct, the script will fail with a 
`STATUS_INVALID_COMPUTER_NAME` error.

[python-shield]: https://img.shields.io/badge/python-3.6-green

文件快照

备注